yashsingh1/xdaforums huggingface dataset:
[Android Software/Hacking General [Developers Only]] Alex1948:
ReadBack ROM

`It is very simple :

In SP Flash Tool load file scater.txt(about me - MT6572_Android_scatter_emmc) and click Red back and the line appears :

N/A(ticket) Start address = 0x000000.... Lenght = 0x00001000 File = ROM_0.Double click on it , then Save ROM_0)

Then there window Read back block start address . Have to write : Start address=0x000000 , Lenght = 0x3c9c0000(is my block address CACHE from my scatter.txt file).You may have other.In your case, Lenght is 0x2c740000 , CACHE block address of yours scatter file.

Then click on button read back (next button Remove) , power off the phone and remove the battery , Insert the battery and begin writing.

It takes about 15 minutes , and the resulting file ROM_0 , it has no extension. - see picture 1

As seen in the image, this file(ROM_0) has 1.016.856.577 bytes or 969 MB , write 15 min 04 sec , opens with MTKdroid Tools -->root,backup,recovery-->To Process File ROM_from FlashTool (see write [MENTION=5119815]rua1[/MENTION] : " Prepare files for FlashTool and make CWM

If everything passed without errorss, we open the MTK Droid Root & Tools window which we left on 1th step. If for some reason the window isn't present, it is necessary to turn on phone and to connect it to the program. Click on To process file ROM_ from FlashTool button and choose the ROM_* file saved on the 6th step. At successful unpacking rom it will be offered to choose CWM from similar phone. Chosen CWM it is checked on compliance to the connected phone and if ok, the CWM is created.

Starting with v2.4.0 CWM it is made automatically and the file from similar phone shouldn't be looked for any more!""

In MTKdroidTools in folder backups a new folder appears :

A5_Duo_130806_ForFlashtoolFromReadBack_131009-142022(A5_DUO is my phone) , that contains multiple files : recovery.img - original phone , CWM recovery etc. See image number 2 , in my post above.This file : A5_Duo_130806__recovery_131007-212823 is CWM recovery(flash with SPFT see image 3) and this file is original recovery :factory_NONmodified_recovery

Load phone in CWM mode, connect to MTK Droid Root & Tools, go on the tab root, backup, recovery and, pressing on this tab the necessary buttons, we do: Backup see image 4

Write on SDcard extern in /sdcard/clockwordmod/backup.You must have space on sdcad
[Android Software/Hacking General [Developers Only]] PackMan123:
You want to create Cwm flashable ROM. For that you need to use a tool called Android kitchen and you need system.img and boot.img of the ROM. It's very easy to do and there are other comprehensive threads about the subject. Good luck :)
[Android Software/Hacking General [Developers Only]] Alex1948:
Everybody knows

But, who's stopping you to use what you want.For now, talk MTKD and SPFT.If do you need fast is ok.And well.Of course, there are other ways to get a job CWM recovery

But , backup ,and PC and sdcard rule
[Android Software/Hacking General [Developers Only]] sarry86:
I connected the same tab then the correct scatter file was created with the same size but only the name were changed to correct one, I'm getting error 8038 on sp flash tool

Sent from my parachute :P
[Android Software/Hacking General [Developers Only]] syserr:
You should take special precautions - as rua1 has been explaining. Read the last 2 weeks of this thread. Are you sure you have ext4fs and not UBIFS. You said you unpacked the system.img with an ext4 tool, so... :crossfingers:

FYI, you don't need any MD5SUM for CWM-style ROMs, but you do for NANDROID backups.

If you would like to make a CWM-style ROM, you can get some help from Android Kitchen as was said above.

I've you want to discuss repacking ROMs, I think we should start another thread.
[Android Software/Hacking General [Developers Only]] Alex1948:
Scatter file

08/12/13 08:44:22 -----------Start------------ v2.5.1 (1386264346) 05.12.2013 17:25:46

08/12/13 08:52:22

--->>> Connect to device <<<---

08/12/13 08:52:22 -rwxrwxrwx root root 795076 2012-06-29 12:18 recovery

08/12/13 08:52:23 /system/etc/firmware/modem_1_wg_n.img

08/12/13 08:52:24 MT6572_S00

08/12/13 08:52:24 3+0 records out

08/12/13 08:52:24 12 bytes (12B) copied, 0.000208 seconds, 56.3KB/s

08/12/13 08:52:24 Hardware : MT6572

08/12/13 08:52:24 Part_Name	Size	StartAddr	Type	MapTo

08/12/13 08:52:24 preloader 0x0000000000600000 0x0000000000000000 2 /dev/misc-sd

08/12/13 08:52:24 mbr 0x0000000000080000 0x0000000000000000 2 /dev/block/mmcblk0

08/12/13 08:52:24 ebr1 0x0000000000080000 0x0000000000080000 2 /dev/block/mmcblk0p1

08/12/13 08:52:24 pro_info 0x0000000000300000 0x0000000000100000 2 /dev/block/mmcblk0

08/12/13 08:52:24 nvram 0x0000000000500000 0x0000000000400000 2 /dev/block/mmcblk0

08/12/13 08:52:24 protect_f 0x0000000000a00000 0x0000000000900000 2 /dev/block/mmcblk0p2

08/12/13 08:52:24 protect_s 0x0000000000a00000 0x0000000001300000 2 /dev/block/mmcblk0p3

08/12/13 08:52:24 seccfg 0x0000000000020000 0x0000000001d00000 2 /dev/block/mmcblk0

08/12/13 08:52:24 uboot 0x0000000000060000 0x0000000001d20000 2 /dev/block/mmcblk0

08/12/13 08:52:24 bootimg 0x0000000000600000 0x0000000001d80000 2 /dev/block/mmcblk0

08/12/13 08:52:24 recovery 0x0000000000600000 0x0000000002380000 2 /dev/block/mmcblk0

08/12/13 08:52:24 sec_ro 0x0000000000040000 0x0000000002980000 2 /dev/block/mmcblk0

08/12/13 08:52:24 misc 0x0000000000080000 0x00000000029c0000 2 /dev/block/mmcblk0

08/12/13 08:52:24 logo 0x0000000000300000 0x0000000002a40000 2 /dev/block/mmcblk0

08/12/13 08:52:24 expdb 0x0000000000a00000 0x0000000002d40000 2 /dev/block/mmcblk0

08/12/13 08:52:24 android 0x0000000028a00000 0x0000000003740000 2 /dev/block/mmcblk0p4

08/12/13 08:52:24 cache 0x0000000017800000 0x000000002c140000 2 /dev/block/mmcblk0p5

08/12/13 08:52:24 usrdata 0x0000000052c00000 0x0000000043940000 2 /dev/block/mmcblk0p6

08/12/13 08:52:24 fat 0x000000004afe0000 0x0000000096540000 2 /dev/block/mmcblk0p7

08/12/13 08:52:24 bmtpool 0x0000000001500000 0x00000000ff9f00a8 2 /dev/block/mmcblk0

So look log.txt with MT6572_S00 and block adress firmvare.info.Should I get a scatter MT6572_Android_scatter_emmc.txt , not what you posted you
[Android Software/Hacking General [Developers Only]] PackMan123:
[MENTION=4905694]sarry86[/MENTION] Change _NODL_PRO_INFO in your scatter file to PRO_INFO .
[Android Software/Hacking General [Developers Only]] sarry86:
Then it refuse the scatter file, that it is illegal :banghead:

Sent from my parachute :P
[Android Software/Hacking General [Developers Only]] PackMan123:
What error does it give when you edit? You should use Notepad to edit and not other text editors.
[Android Software/Hacking General [Developers Only]] sarry86:
I will post it here what it exactly tells me when i try to load a scatter file later when i reach at home

Sent from my parachute :P
[Android Software/Hacking General [Developers Only]] rua1:
Error 8038 usually indicates that the phone is already reflash after factory firmware. It can make any seller.

@sarry86

on your phone, you can get Root shell, install SU and make a backup by simply clicking a ROOT button in the program
[Android Software/Hacking General [Developers Only]] nougiw:
[MENTION=5119815]rua1[/MENTION]

Are you sure you understood what is my problem? The 9th step here http://xdaforums.com/showpost.php?p=38337401&postcount=5

doesn't seem to be related to the problem I explained to you neither correcting it.
[Android Software/Hacking General [Developers Only]] syserr:
If you have a device that you aren't afraid of doing an SPFT "Format" on, then solving this is easy if you are sure you have the correct SPFT-style ROM. You Format, then Download with SPFT. Format forces the specifications of your scatter file on the device, even rewriting the PMT block that in effect in a binary form of the scatter file. I formatted the crap out of my A2107As, but I also new Meta Mode was easy to get into so I couldn't break them by screwing up the preloader block.

Big picture, your new scatter file doesn't match what is already on the phone (in the PMT block). Either the sizes of the partiiton blocks are different or the names (like NODL prefix on names). Alex may be able to help you.

I've found ways to trick SPFT into putting what it reads from the PMT block in it's log file, but it doesn't seem consistent.

If you have no luck, send me a link to your PMT block and new scatter file. I can go at it with a hex editor and probably write a tool.
[Android Software/Hacking General [Developers Only]] sarry86:
PMT block, what is it exactly? I don't see and pmt thingy here :(

Sent from my parachute :P
[Android Software/Hacking General [Developers Only]] PackMan123:
[MENTION=4905694]sarry86[/MENTION] Hello, please try to load this scatter.
[Android Software/Hacking General [Developers Only]] sarry86:
Thank you for your help, but that didn't work, can i upload "firmware.info" and see if you can make a scatter file for me outta that? :(

Sent from my parachute :P
[Android Software/Hacking General [Developers Only]] PackMan123:
Ok, do that but what error do you get with the scatter I uploaded. Is it the same error that you were receiving before ?
[Android Software/Hacking General [Developers Only]] sarry86:
Sent from my parachute :P

---------- Post added at 10:44 AM ---------- Previous post was at 10:25 AM ----------

It said "s dl pc bl invalid file info (5066)"

Sent from my parachute :P
[Android Software/Hacking General [Developers Only]] PackMan123:
[MENTION=4905694]sarry86[/MENTION] Can you try renaming the scatter file I uploaded to MT6572_Android_scatter.txt.

Also use latest version of SPFT as 6572 is still a new SOC and older versions of SPFT won't work. Also use 2.5.1 of MTKDT.

In the first picture :

Are you trying to flash a backup made by MTK Droid tools or a backup that you acquired from somewhere else? In the first case you should use MTK DROID tools to make !Files_to_FlashTool. Backup made by MTKDT aren't directly flashable through SPFT.
[Android Software/Hacking General [Developers Only]] sarry86:
I created the backup from another tab of the same type, and yes i created it using mdt 2.5.1, if i rename that it says the scatter file i am loading is illegal :'(

Sent from my parachute :P

---------- Post added at 11:41 AM ---------- Previous post was at 11:23 AM ----------

Thank you very much, i prepared blocks for flashtool and now it has flashed, the tab is up and running now :)

Sent from my parachute :P
[Android Software/Hacking General [Developers Only]] KornelK:
Hello

I try to install CWM on my Kazam Trooper X40 (MTK 6572) after reboot a I didn't have recovery and my phone bootloop. What should I do please help
[Android Software/Hacking General [Developers Only]] sarry86:
The only error i get now is dev/radio/pttycmd1 not found when i try to write a new imei using MTKDT 2.5.1, i am unable to access it even with root explorer, i already have root access but when i mount the /dev/radio/ there are no any file in here, guys help me here, am stuck

Sent from my parachute :P
[Android Software/Hacking General [Developers Only]] PackMan123:
Deleted.
[Android Software/Hacking General [Developers Only]] Quadrescent:
nice share

its awesome.

thanks
[Android Software/Hacking General [Developers Only]] Syndor:
Does this works for mt8389?

Which as I understand is a subtype of 6589
[Android Software/Hacking General [Developers Only]] sarry86:
Somebody help me here, am stuck here :(

Sent from my parachute :P
[Android Software/Hacking General [Developers Only]] Alex1948:
CWM

Select Blocks Map in the program and look at the Type field opposite to block "system". If in this field it is written "ubifs", or it field is empty, you got . - see post 1 and image [MENTION=5119815]rua1[/MENTION]

---------- Post added at 08:58 AM ---------- Previous post was at 08:42 AM ----------

See MTKdroidTools.ini :

[Platforms]

MTKsocs = ^(MT65(16|72|73|75|77|82|89)|8135)

; Regular expression all MTK SP FlashTool SOCs

SocToScatName = 6513:6573,6515:6575,6517:6577,8317:6577,8377:6577,8389:6589

---------- Post added at 09:19 AM ---------- Previous post was at 08:58 AM ----------

In the Engineer Mode-->Conectivity-->CDS Information-->Radio Information-->Phone1 : Radio is ON ?

you can see AT+ at the top,

touch it,

and type AT+EGMR=1,7,"xxxxxxxxxxxxxxx"

type your 15-digit IMEI in the quotes in place of xxxx...

it will show a message like sent successful.......[i dont remember it...]

now reboot your phone....

for second sim follow same procedure but,

select Phone 2 in radio,

and type AT+EGMR=1,10,"xxxxxxxxxxxxxxx"

type your 15-digit IMEI in the quotes in place of xxxx...

it will show a message like sent successful.......[i dont remember it...]

now reboot your phone....

Try this
[Android Software/Hacking General [Developers Only]] KornelK:
I don't have ubifs. I try restore but I have error s_brom_download_da_fail
[Android Software/Hacking General [Developers Only]] Alex1948:
ERRORS:

ERRORS:

(2005) S_BROM_CMD_STARTCMD_FAIL often there is on phones with MTD type a flash.

During Downloading preloader or dsp_bl aren't marked. To use the suitable version of SPFT or to switch off the DA download All mode.

During Downloading preloader or dsp_bl are marked. Not mark these blocks! Or connect phone in the BOOTROM mode if it is necessary to Download them. See write [MENTION=5119815]rua1[/MENTION].

If you do not understand, I'll explain in more detail.

Attach, log file, scatter file and first recovery of original, or CWM Recovery.SPFT and MTKD with Read Back ,make two files

(A5_Duo_130806__recovery_131007-212823(CWM recovery - A5_DUO is mai phone - 131007(is the file creation date)) and factory_NONmodified_recovery(original recovery phone).

In the first picture the original flash recovery , in the second picture flash CWM Recovery
[Android Software/Hacking General [Developers Only]] lopestom:
In your SPFT backup you see ...sec_ro.bin or nvram??
[Android Software/Hacking General [Developers Only]] sarry86:
---------- Post added at 07:17 PM ---------- Previous post was at 07:12 PM ----------

Unfortunately cds is not available in engineering mode>connectivity
[Android Software/Hacking General [Developers Only]] Alex1948:
???

I do not think that has sec_ro like to upload secro.bin and no nvram in !Files_to_FlashTool.In Read Back I think it has secro.img and nvram.bin.

At least to me, to my phone - see image or complete backup see image 3.
[Android Software/Hacking General [Developers Only]] lopestom:
This backup was made with the latest MTK Droid? protect_f; protect_s; nvram are telefony network files on your phone device. secro file is the part that can make you flash by SPFT.

I write this as my own experience with MT6577 and MT6589. I needed to return IMEI and not resolved. Only resolved with flash on sec_ro.bin with SPFT.

I think all devices MT(K) are like that. Is there other posts behind with discussion about it.

But who can really confirm is only rua1.

For my 2 devices this option was solution.

-----------------Edit:

Generally secro is not written as sec_ro.bin. Always be written as nodl_secro.bin. Then just rename.
[Android Software/Hacking General [Developers Only]] Alex1948:
What backup, mine or his .Right, secro write SPFT - you pic

If you do not see what is saved and how, where and how save.I do not know what is saved and how colleague ,with spft with MTKD , what Scatter file ???

I have a 6575 and a 6572

Probably does not understand certain things

That's right, @ rua1 can confirm , but SPFT
[Android Software/Hacking General [Developers Only]] KornelK:
Now I have S_BROM_DA_DOWNLOAD_FAIL(2004)
[Android Software/Hacking General [Developers Only]] gajah_terbang13:
Samsung Galaxy Mega clone (MT6572) stuck at samsung logo

help me...http://xdaforums.com/showthread.php?p=48586030#post48586030
[Android Software/Hacking General [Developers Only]] PackMan123:
Install MT65xx preloader drivers :D
[Android Software/Hacking General [Developers Only]] syserr:
If you are looking to send IMEI to the phone without that mode, you can do this directly with adb and command line.

adb shell
su
echo 'AT +EGMR=1,7,"IMEI_1"'> /dev/pttycmd1
echo 'AT +EGMR=1,10,"IMEI_2"'> /dev/pttycmd1
[Android Software/Hacking General [Developers Only]] rua1:
v2.5.2 become (bug fix for v2.5.1)
[Android Software/Hacking General [Developers Only]] rua1:
v2.5.2e

Replace exe file in the folder v2.5.2 file from this archive.

https://dl.dropboxusercontent.com/u/44232267/MTKdroidTools_v252e_exe_only.7z
​

Last test version. The algorithm of creation of scatter of new type is improved.

https://dl.dropboxusercontent.com/u/44232267/MTKdroidTools_v252d_exe_only.7z
​

For test UBIFS devices.. Makes three types files of ubifs blocks:

system.ubifs.tar . Archive not for FlashTool!

system.ubifs.img . Not for FT, but there is an opportunity to make the file for FT under Linux

nodl_system.bin . For testing! On responses of some owners is suitable for FT. Demands check.

No guarantees, on your own risk!

The request to owners of UBIFS devices to send log.txt and scatter files, as in the description for v2.5.2b

Description of the previous test version:

https://dl.dropboxusercontent.com/u/44232267/MTKdroidTools_v252b_exe_only.7z​

This version is for testing create a new type of scatter on MT6572 and MT6582 platforms Except phones with UBIFS blocks. Owners 6572 with ubifs and other platforms can be downloaded only for curiosity ;).

Turn on the device normally (CWM mode is wrong!), Press Block Map button and create scatter file. Create two files. First the old type and the second new name will be at the end of '_v111-TestVersion'.

Huge request for people with new type of factory scatter, please archive both files (created by the factory and in the program) and send it to me.
[Android Software/Hacking General [Developers Only]] kuronosan:
Hi rua, the new Omate Truesmart smartwatch uses an MT6572 SoC and I lost the baseband. I've tried just about everything from flashing the secro.img, to the nvram.bin, to trying to use MAUI (I can't seem to get it to recognize the chipset at all) to flash the modem bin generated by MTK.

Is there any way to get my baseband back? I've flashed the stock ROM and nothing happens.
[Android Software/Hacking General [Developers Only]] PackMan123:
[MENTION=5119815]rua1[/MENTION] SPFT loads the new scatter correctly :) Thanks :D
[Android Software/Hacking General [Developers Only]] Alex1948:
The two scatter and log files :

- MT6572_Android_scatter_emmc.txt

- MT6572_Android_scatter_v111-TestVersion.txt

- log.txt
[Android Software/Hacking General [Developers Only]] KopiJahe:
[MENTION=5119815]rua1[/MENTION] can you add the ability to write IMEI with alphabet character?

My phone is CDMA-GSM device, therefore, it's using MEID as IMEI 1, and my phone MEID came with some alphabet character beside numerical like usual IMEI

Thanks in advance
[Android Software/Hacking General [Developers Only]] bovirus:
[MENTION=5119815]rua1[/MENTION]

A) Proposal for improvements.

1. When create the scatter now write CHIPNAME_xxx.txt. Could change it to write before product name like N9600_MTK682_xxx.txt?

2. When create Flashtool folder could you copy inside it also phone.info (info about device related to ROM)?

B) Add new strings

--->>> Connect to device <<<---

--- La cartella di salvtaggio nel computer: k:\ROM test\MTKdroid\MTKdroid_2.5.2b\backups\01_v89_jbl1a698_131024_backup_131223-164427\

--- Non è stata rilevata La scheda SD nel dispositivo!

--- scatter é stato salvato nel file:

k:\ROM test\MTKdroid\MTKdroid_2.5.2b\backups\01_v89_jbl1a698_131024_backup_131223-164427\MT6589_Android_scatter_emmc.txt

--- Salvataggio blocchi:

- preloader_and_dsp

- MBR

- EBR1

- nodl_pmt

- PMT tables found

- PMT tables OK, 22 blocks found

- nodl_pro_info

- nvram.bin

- userdata_nvram_only.tar

- nodl_seccfg

- uboot.bin

- boot.img

- recovery.img

- secro.img

- nodl_misc

- logo.bin

- EBR2

- nodl_expdb

--- Copia del contenuto delle cartelle nel PC

- /data/nvram

- /system

--- Compressione nell'archivio: k:\ROM test\MTKdroid\MTKdroid_2.5.2b\backups\01_v89_jbl1a698_131024_backup_131223-164427.zip

The string in bold are untranslated.

Please the string (in bold) in the language file.

C) Italian language updated.

I attached a new revision of italian language.

D) Use of SD to backup system

The program (2.5.2) say that without a SD card it cannot copy system and suer data. Is it true?

Because also without an SD after root/enable recovery I can save system.img.

Thanks. Bye.
[Android Software/Hacking General [Developers Only]] Byte_Me:
Just wanted to let you know that the tool works to create CWM boot on ZTE V965.

I am very happy now, thanks!
[Android Software/Hacking General [Developers Only]] bigrammy:
Hi [MENTION=455439]bgcngm[/MENTION] did you guys come up with a bullet proof way to increase the recovery partition by stealing some of Sec_ro :confused:

Must we edit everything MBR, EBR, fastab etc :confused:

It would be great if someone could automate the procedure [MENTION=5119815]rua1[/MENTION] or [MENTION=4478781]yuweng[/MENTION] because we could really do with a larger recovery partitions. I assume the procedure would also work for re-sizing the data partition by stealing some the internal sdcard memory too :laugh: Just thinking aload :fingers-crossed:
[Android Software/Hacking General [Developers Only]] yuweng:
i think Master Shifu Javum has just did that with a resize MT6582_Android_scatter.txt & SPFT Checksum.ini... :cowboy: But i couldn't make sense of his mod... :laugh:

Source here

--------------------------------

Whoops, just realize the new scatter.txt recovery partition_size: 0xc00000 = 12582912 byte = 12Mb... :o
[Android Software/Hacking General [Developers Only]] syserr:
I've built a small tool to read in a scatter file, adjust size, then write out scatter MBR EBRx. It works on traditional scatter files. One thing I've found is MediaTek has a problem when the data FS is larger than 2gb. The sync of /data/nvram and NVRAM partition has errors and boot fails.

I need to add a few features and get it on github.
[Android Software/Hacking General [Developers Only]] agismaniax:
Hi [MENTION=5119815]rua1[/MENTION]

I try to follow this tutorial with my ZTE N986. But when the readback process reached >800MB, the process stopped with error code 4009. What does it mean?
[Android Software/Hacking General [Developers Only]] fun145:
thanks rua

i successfully created scatter files (both) and furthermore i succesfully rooted phone with you mtkdroidtools. I would like to thanks a lot to you rua 1

here are the links to all my files:

scatter files
http://dfiles.eu/files/bgv1bmboc
http://dfiles.eu/files/ah3nlvyyl
log file
http://dfiles.eu/files/wbt1gl0t6

really thanks a lot for your great work rua1

best regards

fun145
[Android Software/Hacking General [Developers Only]] kuronosan:
Still having trouble restoring the IMEI/NVRAM of MT6572 Omate/Umeox device.

Are there any files I can upload to help?
[Android Software/Hacking General [Developers Only]] agismaniax:
Afaik, IMEI is unique and you can't use IMEI/NVRAM from others. But you can recover/repair it with IMEI tools.

You can check that tools in this thread http://en.miui.com/thread-10061-1-1.html.
[Android Software/Hacking General [Developers Only]] a.marduk:
file scatter from Note 3 supercopy using MTKdroidToolsv252b

i just knew about this version...

already backup the phone with version 252 and backup the imei,

formatting the phone yesterday with sp flashtool, and flashing the firmware from the backup (v252) (my cousin and i have 2 different version of note 3 supercopy). work perfectly
[Android Software/Hacking General [Developers Only]] rua1:
v2.5.2d for test UBIFS devices become
[Android Software/Hacking General [Developers Only]] biobio76:
Thank you so much dear Rua

I will test it with my ubifs phone this evening and

Provide you log and results

Thanks!
[Android Software/Hacking General [Developers Only]] ghpk:
can't run tool, even though drivers for phone is installed correctly

Able to Run SP_Flash_Tool and connect phones using ADB etc.

screenshot attached